From 01a643468d059d7d09f752ad6328dc916f486ef5 Mon Sep 17 00:00:00 2001
From: Nick Sweeting <git@sweeting.me>
Date: Thu, 27 Aug 2026 17:38:33 -0700
Subject: [PATCH] publish verified images independently of Python tags

---
 .github/workflows/release.yml             | 7 ++++---
 archivebox/tests/test_release_workflow.py | 8 ++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 314a626e..52bbcc58 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -159,8 +159,7 @@ jobs:
     name: Publish tested multiarch image
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      needs.python-release.outputs.release_ready == 'true'
+      github.event.workflow_run.event == 'push'
     needs: python-release
     runs-on: ubuntu-24.04
     permissions:
@@ -296,7 +295,8 @@ jobs:
         run: |
           set -Eeuo pipefail
           VERSION='${{ needs.python-release.outputs.version }}'
-          for image in "${DOCKERHUB_IMAGE}:${VERSION}" "${GHCR_IMAGE}:${VERSION}"; do
+          SHORT_SHA="${RELEASE_SHA::12}"
+          for image in "${DOCKERHUB_IMAGE}:sha-${SHORT_SHA}" "${GHCR_IMAGE}:sha-${SHORT_SHA}"; do
             "$DOCKER_BINARY" buildx imagetools inspect "$image" >/dev/null
             INSTALLED_VERSION="$("$DOCKER_BINARY" run --rm "$image" --version)"
             test "$INSTALLED_VERSION" = "$VERSION"
@@ -311,6 +311,7 @@ jobs:
 
   cascade:
     name: Cascade verified release
+    if: needs.python-release.outputs.release_ready == 'true'
     needs:
       - python-release
       - docker-release
diff --git a/archivebox/tests/test_release_workflow.py b/archivebox/tests/test_release_workflow.py
index 602d0b84..8e925dcd 100644
--- a/archivebox/tests/test_release_workflow.py
+++ b/archivebox/tests/test_release_workflow.py
@@ -21,6 +21,8 @@ def test_release_uses_registered_publisher_and_authorized_tag_credentials():
     checkout = python_release["steps"][0]
     assert checkout["with"]["token"] == "${{ secrets.RELEASE_GH_TOKEN || github.token }}"
     assert docker_release["needs"] == "python-release"
+    assert "release_ready" not in docker_release["if"]
+    assert jobs["cascade"]["if"] == "needs.python-release.outputs.release_ready == 'true'"
 
     published_install = next(
         step for step in python_release["steps"] if step.get("name") == "Verify published PyPI package installs and runs"
@@ -38,6 +40,12 @@ def test_release_uses_registered_publisher_and_authorized_tag_credentials():
     assert 'echo "${DOCKERHUB_IMAGE}:sha-${SHORT_SHA}"' in tag_script
     assert 'echo "${DOCKERHUB_IMAGE}:${VERSION}"' in tag_script
 
+    docker_verify = next(step for step in docker_release["steps"] if step.get("name") == "Verify published Docker images run")
+    verify_script = docker_verify["run"]
+    assert '"${DOCKERHUB_IMAGE}:sha-${SHORT_SHA}"' in verify_script
+    assert '"${GHCR_IMAGE}:sha-${SHORT_SHA}"' in verify_script
+    assert '"${DOCKERHUB_IMAGE}:${VERSION}"' not in verify_script
+
     release_script = (REPO_ROOT / "bin" / "release.sh").read_text()
     assert "Never create GitHub Releases for automated rc builds" in release_script
     assert "--prerelease" not in release_script